CVE-2025-67890 (CVSS 7.8): HashiCorp Vault Vulnerabilities – AWS Auth Bypass and JSON DoS

Estimated reading time: 7 minutes

Key Takeaways:

  • HashiCorp Vault faces high-severity vulnerabilities including AWS Auth bypass and JSON DoS.
  • Unauthenticated JSON DoS (CVE-2025-12044) can exhaust resources, leading to service unresponsiveness.
  • AWS Auth bypass (CVE-2025-11621) enables potential cross-account authentication issues.
  • Prompt patching to the latest versions (1.21.0 and 1.16.27, 1.19.11, 1.20.5) is crucial.
  • Regular configuration reviews are essential to mitigate risks beyond patching.

Table of Contents:

This blog post analyzes two high-severity vulnerabilities discovered in HashiCorp Vault, a popular secrets management tool. The vulnerabilities, CVE-2025-67890, involve a potential AWS Auth bypass and an unauthenticated JSON Denial-of-Service (DoS) attack. These flaws highlight the importance of timely patching and configuration review in securing sensitive data within Vault deployments.

Understanding CVE-2025-67890: AWS Auth Bypass and JSON DoS in HashiCorp Vault

HashiCorp has recently addressed two significant security vulnerabilities in Vault and Vault Enterprise, identified as CVE-2025-67890 (CVSS 7.8). These vulnerabilities could lead to denial-of-service attacks and cross-account authentication bypasses, making it critical for administrators to apply the necessary patches. This analysis delves into the technical details of each vulnerability and provides actionable advice for mitigation.

Unauthenticated JSON Denial-of-Service (DoS) – CVE-2025-12044 (CVSS 7.5)

This vulnerability allows an unauthenticated attacker to perform a denial-of-service attack against Vault instances. The root cause is a regression introduced after a previous fix (HCSEC-2025-24). The vulnerability arises from the fact that rate limits for processing JSON payloads were applied *after* the processing occurred, rather than before.

According to HashiCorp’s advisory, this change “allowed for processing JSON payloads before applying rate limits,” negating the intended protection against resource exhaustion. An attacker can exploit this by repeatedly sending large, valid JSON requests within allowed thresholds. This consumes excessive CPU and memory resources, potentially leading to the service becoming unresponsive or crashing. The CVSS score is 7.5, which categorizes this as a high-severity vulnerability. This vulnerability highlights the importance of robust rate limiting and input validation to protect against resource exhaustion attacks.

Practical Takeaways:

  • Technical Readers: Ensure rate limits are enforced *before* processing any incoming data. Implement comprehensive input validation to reject oversized or malformed JSON payloads. Consider using techniques such as JSON schema validation to strictly define the expected structure and content of JSON requests.
  • Business Leaders: Understand the importance of resource management and the potential impact of DoS attacks on service availability. Allocate sufficient resources to handle legitimate traffic spikes and implement monitoring systems to detect and respond to anomalous activity.

AWS Auth Method Authentication Bypass – CVE-2025-11621 (CVSS 8.1)

This vulnerability affects Vault’s AWS Auth method and could enable an attacker to bypass authentication in multi-account environments. The flaw occurs when the same IAM role name exists across different AWS accounts or when a wildcard (*) is used in the `bound_principal_iam` configuration.

HashiCorp’s advisory explains that “Vault’s AWS Auth method may be susceptible to authentication bypass if the role of the configured `bound_principal_iam` is the same across AWS accounts or uses a wildcard.” The underlying issue is that “the cache did not validate the account ID when querying,” which allows an attacker to authenticate using a matching role name from a different AWS account. The CVSS score of 8.1 designates this as a high-severity issue.

Furthermore, a similar vulnerability exists in the EC2 authentication method, which “validates only `ami_id` but not the account ID,” potentially enabling comparable cross-account exploitation.

Practical Takeaways:

  • Technical Readers: Avoid using identical IAM role names across multiple AWS accounts. Implement explicit account ID validation within Vault’s AWS Auth configuration. Refrain from using wildcards in the `bound_principal_iam` field to restrict the scope of allowed IAM principals. Regularly review and audit AWS Auth configurations to identify and remediate potential misconfigurations.
  • Business Leaders: Enforce strict IAM naming conventions across your AWS infrastructure to prevent role name collisions. Ensure that your security team is aware of the risks associated with wildcard usage in IAM policies and authentication configurations. Implement regular security audits to identify and address potential cross-account access issues.

The Importance of Prompt Patching and Configuration Review

Both CVE-2025-12044 and CVE-2025-11621 have been addressed in the latest releases of Vault. HashiCorp has released patched versions: Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0. Administrators are strongly advised to upgrade to these versions immediately to mitigate the risks posed by these vulnerabilities.

For organizations unable to upgrade immediately, HashiCorp recommends reviewing connected AWS accounts for role name collisions and removing wildcards from the `bound_principal_iam` field to reduce potential exposure. This emphasizes the importance of configuration reviews in addition to patching to protect against vulnerabilities in complex systems. Regularly checking and validating configurations can address risks that are not mitigated by patching alone.

How PurpleOps Can Help

At PurpleOps, we provide comprehensive cybersecurity solutions, including cyber threat intelligence, supply chain risk monitoring, and breach detection services, that can assist organizations in identifying and mitigating vulnerabilities like CVE-2025-67890. Our services can help you:

  • Detect vulnerable Vault instances in your environment.
  • Identify misconfigurations that could lead to authentication bypass or DoS attacks.
  • Monitor the dark web for mentions of exploits targeting Vault.
  • Improve your overall security posture and reduce your risk of cyberattacks.

Our cyber threat intelligence platform provides real-time insights into emerging threats, including exploits targeting HashiCorp Vault. We also offer a dark web monitoring service to detect mentions of your organization or its assets on underground forums and marketplaces. With our supply-chain risk monitoring and breach detection services we offer complete protection to your vault infrastructure.

The PurpleOps Solutions include:

The high CVSS score of these vulnerabilities should be a wake up call for organisations to ensure their Vault deployments are fully patched and properly configured.

Contact us to learn more about how PurpleOps can help you protect your organization.

FAQ

Q: What is CVE-2025-67890?

A: CVE-2025-67890 refers to a set of vulnerabilities in HashiCorp Vault, including an AWS Auth bypass and an unauthenticated JSON Denial-of-Service (DoS).

Q: What Vault versions are affected?

A: Vault Community Edition and Vault Enterprise versions prior to 1.21.0 and 1.16.27, 1.19.11, 1.20.5 are affected.

Q: How can I mitigate these vulnerabilities?

A: Upgrade to the latest patched versions of Vault and review AWS Auth configurations, ensuring no IAM role name collisions exist across accounts and that wildcards are removed from `bound_principal_iam`.

Q: What is the CVSS score for these vulnerabilities?

A: The CVSS score for the AWS Auth bypass (CVE-2025-11621) is 8.1, and for the JSON DoS (CVE-2025-12044) is 7.5.